preface

In a previous article: Using SonarQube to check engineering code quality in A Windows environment, we have implemented code quality checks for projects using SonarQube in Windows 7. Next, we will integrate the original construction process of the project. When Jenkins is building, before executing the build script, we will conduct code quality inspection through SonarQube. So the previous process looked like this:

  1. Users submit branches or tag, triggering the hook mechanism set by Jenkins
  2. Jenkins receives the hook and pulls the corresponding branch down
  3. Finally, execute the build script (for example, package it if it is a GO project, then distribute the binary to the corresponding server, restart the service, and synchronize the modified code file to the online service if it is a PHP project).
  4. If there are other hooks, such as a pin notification, one will be pushed to the corresponding group when the package starts and when the package ends

The SonarQube build process becomes

  1. Users submit branches or tag, triggering the hook mechanism set by Jenkins
  2. Jenkins receives the hook and pulls the corresponding branch down
  3. Once the branch is pulled down, code quality is checked through Sonar scanner and reports are generated to sonar backend
  4. Finally, execute the build script (for example, package it if it is a GO project, then distribute the binary to the corresponding server, restart the service, and synchronize the modified code file to the online service if it is a PHP project).
  5. If there are other hooks, such as a pin notification, one will be pushed to the corresponding group when the package starts and when the package ends
  6. Developers can go to Sonar to see test reports

Point 3 and point 6 are added.

In field

Again, to get a more realistic taste of the effect, I’ll recreate the process in the local environment window 7. Reinstall Jenkins locally, but gitLab’s internal codebase will still use the internal environment directly. SonarQube is a Windows environment using SonarQube to check the quality of engineering code this one, local has installed.

There are some links in the process above, which I will not deal with, because they have nothing to do with what I want to show in this article. Moreover, they are very simple and can be configured by themselves:

  1. The mode of gitlab hook trigger construction will not be matched. Normally, we will directly trigger Jenkins construction by gitlab hook. Generally, I will not go to Jenkins background to manually click the build button (unless the project is to go online to the production environment), but because Jenkins is deployed locally and the address is localhost, the gitLab on the line is configured hook, so it cannot come to my local, so in the follow-up test, All of them were handled by manual and active construction in Jenkins background
  2. Executing scripts is also ignored because it has nothing to do with code quality checks, and scripts vary from project to project.
  3. You don’t need that either

Install Jenkins

Go to the Jenkins download page and select the Windows version, the latest version is 2.263.1, download the file Jenkins. Msi, double click to install

Go to this place and copy the password and paste it in

At this point, go to beginner’s and install the plug-in he recommends

Once installed, create an admin account

Just to make sure

The installation is successful. This is what the interface looks like for the first time

Install and configure the SonarQube plug-in

So let’s install SonarQube, go to plug-in management, go to SonarQube

Select Download and restart

At this point, you will enter the download center, and then after downloading, check the check box for restart

When you’re done, you can find it over here

Next we need to configure SonarQube to generate a Token (PS: instead of entering the user name and password) in the SonarQube background to the Security page. Select the Administrator user to view the token

Can see before running the three projects, has generated three token, my side to regenerate into 017 ff87ea20c68b1c0f9ea1be799f56325356f62 Jenkins, a special used for later use

Now that the token is generated, the next step is to configure the address in Jenkins to connect to the SonarQube server. The token used here is the one created in SonarQube

Find SonarQube Servers configuration side

Then fill in the information.

Here to add a token certificate, if click no drop-down option. I’m going to save it, and then I’m going to hit Add, and then I’m going to create a secret Text credential, and I’m going to document it

Installation

  1. Install the SonarScanner for Jenkins via the Jenkins Update Center.
  2. Configure your SonarQube server(s):
  3. Log into Jenkins as an administrator and go to Manage Jenkins > Configure System.
  4. Scroll down to the SonarQube configuration section, click Add SonarQube, and add the values you’re prompted for.
  5. The server authentication token should be created as a ‘Secret Text’ credential.

Finally, after you hit Add, you’re ready to choose

Finally, click Apply and Save, and you’re all configured.

Finally, you need to configure the global tool configuration

Go to SonarQube Scanner, fill in the Scanner noun you just created, and check Install Automatically

Finally, click apply and Save, and the entire SonarQube is configured.

Create a project test

Next, let’s create a task to test if the build triggers code quality checks

Next, we started to configure the internal project of GitLab. We pulled it in the way of HTTP, and we need to create a certificate authorization first, and input the user name and password of Gitlab, so that we can have the permission to pull the project.

If there are no errors when you fill it in, you should be ok. If SSH is selected, the user name and password cannot be used. Otherwise, an error will be reported

In order not to conflict with the branch above the code, I pulled a new branch called test based on the master branch so that it would not affect the existing build online.

Moving on to the Build Environment, select SonarQube for code inspection before building

There is a warning, don’t worry about it.

To continue to the build step, select Execute SonarQube Scanner

And then set it up

This is a bunch of stuff that I copied in Resources and then tweaked a little bit

Sonar. ProjectKey = my_demo sonar. The projectName = my_demo sonar, sonar projectVersion = 1.0. Language = Java sonar.sourceEncoding=UTF-8 sonar.sources=$WORKSPACE sonar.java.binaries=$WORKSPACECopy the code

Click Apply, then Save. At this point, the configuration is complete.

In fact, for the standard process, there are two steps missing from the configuration, one is to configure gitlab hook:

One is to set up the build execution script

However, the absence of these two steps does not affect our testing purposes. Interested, can refer to the reference documents behind, their own test, not difficult.

Let’s click Build Now and see if it works

Note that we don’t have gitLab’s Webhook notification plugin installed, so we can only pull it manually. There is no way to trigger it automatically through the push test branch

Sonar Scanner: Sonar Scanner: Sonar Scanner: Sonar Scanner: Sonar Scanner: Sonar Scanner

ERROR: Invalid value of sonar.sources for my_demo INFO: ------------------------------------------------------------------------ INFO: EXECUTION FAILURE INFO: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- the INFO: Total time: 25.289 s INFO: Final Memory: 5M/27M INFO: ------------------------------------------------------------------------ ERROR: Error during SonarScanner execution ERROR: The folder 'C:Windowssystem32configsystemprofileAppDataLocalJenkins.jenkinsworkspacemy_demo' does not exist for 'my_demo' (base directory = C:\Windows\system32\config\systemprofile\AppData\Local\Jenkins\.jenkins\workspace\my_demo) ERROR: ERROR: Re-run SonarScanner using the -X switch to enable full debug logging. WARN: Unable to locate 'report-task.txt' in the workspace. Did the SonarScanner succeed? WARN: Unable to locate 'report-task.txt' in the workspace. Did the SonarScanner succeed? ERROR: SonarQube scanner exited with non-zero code: 1 Finished: FAILURECopy the code

It seemed that I could not find the project directory, but I went to check and found that the above directory existed, and then I checked to see if there was any configuration related to the directory in the above steps. Later, I found that there might be something wrong with the configuration copied from others:

sonar.sources=$WORKSPACE
sonar.java.binaries=$WORKSPACE
Copy the code

So remove these two configurations and keep only the top five

Sonar. ProjectKey = my_demo sonar. The projectName = my_demo sonar, sonar projectVersion = 1.0. Language = Java sonar.sourceEncoding=UTF-8Copy the code

That’s how it turned out

Back at SonarQube, we finally see the analytics.

Next I’ll format it slightly in the Test branch and push it again, then build now again

You can see the analysis is continuing. Also successful, you can see that he only checks the modified code based on the last analysis, because I did not modify the code this time, so the analysis results are all 0.

conclusion

With Jenkins and SonarQube built locally, together with gitLab’s internal library online, we can implement code quality inspection through SonarQube in advance during code construction.

References:

  • Jenkins integrates SonarQube Scanner
  • SonarSource/sonar-scanning-examples
  • sonarscanner-for-jenkins
  • Gitlab uses Webhook to realize Jenkins automatic construction after Push code

See my personal site: kebingzao.com/ for more good articles